Executive brief
use-reducer-async is a React utility library for managing async state updates. Between May 18–19, 2026, an attacker compromised the repository and injected malicious code into the default branch that executed during npm install on developer machines. The attack fetched and executed attacker-controlled code with full Node.js process permissions, giving an attacker complete access to developer credentials, SSH keys, cloud accounts, and any sensitive data accessible from the workstation.
Technical details
The vulnerability is a supply-chain attack involving arbitrary code execution (RCE) through npm postinstall scripts. Malicious commits (da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb) added src/install.js, wired into package.json's postinstall hook, that fetched and evaluated a remote JavaScript payload via HTTPS with TLS verification disabled. Execution was deliberately skipped on CI/cloud systems to target developer workstations. Attack vector: local, triggered by npm install against affected Git commits (not published to npm). The second-stage payload is not recoverable; full machine compromise should be assumed. The root cause was a compromised maintainer account due to infected development machine. No patch is available; remediation requires treating affected machines as fully compromised.
Affected products
- dai-shi use-reducer-async da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb (Git commits; not published to npm)
Timeline
- 2026-05-18: other: Malicious commits pushed to default branch
- 2026-05-19: other: Compromise detected (approximately 8 hours after injection)
- 2026-05-19: other: Malicious commits removed via force-push
- 2026-05-22: disclosed: GitHub Security Advisory published
- 2026-08-10: advisory: CVE-2026-48159 published